Hardware disk encryption

Apatch

Hello, friends!
I need a solution for hardware (SED) full disk encryption that will work independently of the operating system. Descripting should be done through the TPM module. LUKS and BitLocker are not suitable, and encryption via BIOS is also not an option, since not all BIOS can work with SED. I am looking for something like Sedutil. The goal is that the end client does not feel that his disk is encrypted, and if it is stolen, you cannot see the information. Only that the disk should start on a specific machine.
I will be very grateful for any information.

sysadmin

In order to solve a problem, think about the problem itself, then try to solve it at concept level, then implement a technical solution.

The problem in your requirement is conceptual. For example you want a hardware encryption for some data. Whatever is encrypted at a hardware default level, can also be decrypted at the same hardware level. Therefore this brings the question: what is the purpose of encrypting it, if it is not secure with something personal?

The hardware encryption would need a password or something to be unlocked by you and only you. If it is hardware without password or identifiable information, then anyone who has the hardware can access the data, because it is just that: hardware. Let's assume you also bring another hardware into equation (like motherboard ID + specific RAM + some CPU ID) like some sort of requirement, but again one can simulate all that and bruteforce the damn locking encryption, because there are not that many combinations of hardware out there.

For the sake of brainstorming the idea, let's assume one creates such hardware with a default encryption. No matter how much computing encryption you give that hardware, in a few years it will become obsolete. Technology evolves, no matter how you think of it. It is just a matter of time until some closed-source encryption today will be decrypted later as algorithm becomes obsolete. This is especially valid with hardware, which has just one encryption without variations (due to hardware constraints and cost constraints, otherwise one might as well go with software on a full modern CPU hardware)/

All this brings us back to good software: which is based on password/keys and it is open source. This is one of the most reliable solutions because it is done by you, with variations by you, and keys and passwords set by you.

To answer the question of encryption: just grab some cloud or NAS and store there your data encrypted by your computer or your devices with your password.

If you need a virtual partition encrypted, I recommend VeraCrypt software.
If you need to store something on cloud using vaults (this will create many encrypted small files with random names because some cloud have limitations on files sizes), I recommend CryptoMator.

Apatch

Thanks for your reply, I really appreciate it
At a conceptual level, my problem is:
A single disk encryption logic is needed, regardless of axis or iron, so that data cannot be stolen only when the disk is physically stolen, so that everything works correctly in the system itself, I do not insist on using SED or TPM, it just seems to me that this technology stack is the most suitable for solving my problem, I looked for a long time in the direction of Sedutil, but rested on the impossibility of automatically unlocking the disk, since the native PBA cannot do that, and I simply do not have the knowledge or experience to create my own PBA, maybe there are some approximate alternatives, anything will do that at least remotely there will be solutions to this issue

sysadmin

So you want data encrypted when data is at rest (computer closed, HDD stolen, whatever). I recommend VeraCrypt. You can use it to create a virtual partition as a huge file, then mount/unmount it as needed. If HDD is stolen even when computer is using the partition, data is encrypted, because that partition (file) is unlocked only while computer is running and file is mounted.

Keep in mind this system can not be used to escape authorities (like police or interpol) because when they take a computer they literally freeze it, keeping the data in RAM so they may restore the system in case they need it for investigations as in a running state (with encrypted data unlocked).

Apatch

Thank you very much for your reply and your time